With development of network technologies and increasing expansion of a network scale, types of network devices and types of services carried on a network gradually increase, which greatly increases possibilities that various faults or performance problems occur on a network. Meanwhile, requirements on user service quality are increasing, and consequently, difficulty of network management increases. A network traffic analysis system is configured to monitor network devices and network operation traffic to find abnormal conditions on a network in time so as to warn a network administrator to take necessary measures to ensure normal network operation.
OpenFlow is a protocol for implementing software defined networking (SDN), and a basic idea of an OpenFlow network is to separate a data forwarding plane from a control plane. An OpenFlow switch is responsible for data forwarding on the data plane, and a controller implements a function of the control plane. The switch communicates with the controller using the OpenFlow protocol, and the controller manages the switch using the OpenFlow protocol. The OpenFlow switch is mainly responsible for data forwarding. After receiving a data packet, the OpenFlow switch matches the data packet with a flow entry in a flow table, and forwards the data packet according to the flow entry if the data packet matches the flow entry. The OpenFlow switch has a single counter field in each flow entry, where the counter field is used to count a data packet that matches a flow entry. Therefore, statistics collection on a data flow can be supported definitely.
A structure of multiple flow tables is introduced to the OpenFlow 1.2 version and later versions, where a switch includes one or more flow tables used for level-be-level query and forwarding, and one data flow is forwarded after matching is performed level by level between multiple flow tables and the data flow, which implements flow table compression. However, the following problems are caused inevitably: each data flow is forwarded after matching is performed between a combination of flow entries in multiple flow tables and the data flow, and each flow entry is not targeted for a single data flow any longer. Therefore, complete information of a single data flow cannot be obtained from a flow table, that is, statistical data of the data flow cannot be acquired from a counter field in a flow entry.